| 247 | } |
| 248 | |
| 249 | function isValidRequestPath(path: string): boolean { |
| 250 | if (path === '' || path.length > 2048) { |
| 251 | return false; |
| 252 | } |
| 253 | if (path[0] !== '/' || path.startsWith('//')) { |
| 254 | return false; |
| 255 | } |
| 256 | if (/[?#]/.test(path)) { |
| 257 | return false; |
| 258 | } |
| 259 | // reject control characters and whitespace (CR/LF/space/tab/etc.) — the |
| 260 | // request-smuggling guard. Mirrors Lua's `%c%s`. |
| 261 | for (let i = 0; i < path.length; i++) { |
| 262 | const code = path.charCodeAt(i); |
| 263 | if (code <= 0x20 || code === 0x7f) { |
| 264 | return false; |
| 265 | } |
| 266 | } |
| 267 | return true; |
| 268 | } |
| 269 | |
| 270 | function getRequestPath(transforms: Transform[]): string | undefined { |
| 271 | let path: string | undefined; |